Security is a first-class concern at SecurelyFax. This page describes our technical and organizational measures.
Encryption
- At rest: AES-256 via AWS KMS for all fax PDFs and backups.
- In transit: TLS 1.2+ for every connection (web, API, webhooks, SES, Stripe, Telnyx).
- Passwords: hashed with Argon2id (memory-hard, side-channel resistant).
- Download links: pre-signed S3 URLs that expire within minutes; never embedded in webhook bodies.
Access control
- Per-tenant authorization on every read; users can never access another user's S3 keys.
- Optional two-factor authentication via email code.
- Per-user, revocable API keys.
- Privileged admin actions are audit-logged.
Network & webhook security
- SNS/SES inbound signatures verified with cert pinning.
- Telnyx webhooks verified with public-key signatures.
- Stripe webhooks verified with the Stripe signing secret.
- Outbound webhooks signed with HMAC-SHA256 and a timestamp for replay protection.
Backups & durability
Nightly encrypted database snapshots are taken via pg_dump and uploaded to a separate S3 prefix outside the per-tenant namespace, with 30-day retention.
Incident response
Suspected security issues should be sent to security@securelyfax.com with details. We acknowledge within 2 business days and will notify affected customers without unreasonable delay if a breach is confirmed, consistent with HIPAA breach-notification requirements where applicable.
Responsible disclosure
We do not currently run a paid bug-bounty program but we are grateful for responsible disclosure. We will not pursue legal action against researchers who:
- Make a good-faith effort to avoid privacy violations and service degradation.
- Do not exfiltrate more data than necessary to demonstrate the issue.
- Give us a reasonable opportunity to fix the issue before public disclosure.